Not sure about Windows 10, but on Windows 7, you can add a column called "Command Line" to the Task Manager Processes view (on Windows 10, it may be on the Details view). If you check the command lines used for the various processes, do they include any isolation flags such as -no-remote or -new-instance? The memory usage seems a little low for that, actually. Any other parameters on the command line?

In a long past small Firefox processes like these have been connected to malware.

Boot the computer in Windows Safe mode with network support to see if that has effect in case security software is causing problems.

• http://www.bleepingcomputer.com/tutorials/how-to-start-windows-in-safe-mode/
• http://www.7tutorials.com/4-ways-boot-safe-mode-windows-10

Do a malware check with several malware scanning programs on the Windows computer.

• https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware

Please scan with all programs because each program detects different malware. All these programs have free versions.

Make sure you update each program to get the latest version of their databases before doing a scan.

• Malwarebytes' Anti-Malware:
  http://www.malwarebytes.org/mbam.php
• AdwCleaner:
  http://www.bleepingcomputer.com/download/adwcleaner/
  http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml
• SuperAntispyware:
  http://www.superantispyware.com/
• Microsoft Safety Scanner:
  http://www.microsoft.com/security/scanner/en-us/default.aspx
• Windows Defender:
  http://windows.microsoft.com/en-us/windows/using-defender
• Spybot Search & Destroy:
  http://www.safer-networking.org/en/index.html
• Kasperky Free Security Scan:
  http://www.kaspersky.com/security-scan

You can also do a check for a rootkit infection with TDSSKiller.

• Anti-rootkit utility TDSSKiller:
  http://support.kaspersky.com/5350?el=88446

See also:

• "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked

jscher2000 said

Not sure about Windows 10, but on Windows 7, you can add a column called "Command Line" to the Task Manager Processes view (on Windows 10, it may be on the Details view). If you check the command lines used for the various processes, do they include any isolation flags such as -no-remote or -new-instance? The memory usage seems a little low for that, actually. Any other parameters on the command line?

Here you go. For you cor-el, I will get to that. it's going to take a while though. Scanning takes a very long time mind you and I have to uninstall all the ones I don't use once I scan with them.

The small Firefox process looks like it comes from Malwarebytes as you can see by the URL it tries to open, so maybe check that first.

cor-el said

The small Firefox process looks like it comes from Malwarebytes as you can see by the URL it tries to open, so maybe check that first.

This is not the case. I simply clicked one of the links you provided from my Mail app on Windows 10 to demonstrate the command line. It would be whatever the external link actually is.

The larger process shows it was started by launching to the Profile Manager. If I recall correctly, this is a known problem with starting up in the profile manager (select a profile at startup), that external links are not directed to the instance of Firefox launched from the profile manager.

If you use the Profile Manager then try to set a checkmark in the box to use this profile by default.

• Use the selected profile without asking at startup

I have tried that suggestion, going as far as disabling the default and reenabling it, but it did not solve the problem.

re11ding said

I have tried that suggestion, going as far as disabling the default and reenabling it, but it did not solve the problem.

I'm not sure what you mean. When you set Firefox to start up automatically with a particular extension profile, the command line in the Task Manager should not have -P on it. It should just be a plain command line. If that's not working normally, you may need to edit the shortcut you use to start Firefox to remove the -P by hand from the Target field.

jscher2000 said

I'm not sure what you mean. When you set Firefox to start up automatically with a particular extension profile, the command line in the Task Manager should not have -P on it. It should just be a plain command line. If that's not working normally, you may need to edit the shortcut you use to start Firefox to remove the -P by hand from the Target field.

I'm confused where you got the idea that the command line had a -P in it anywhere. I only launched firefox with -P once to disable the default profile and then reenable the default. The screenshot demonstrates that no -P is in the command line. I apologize for the confusion.

EDIT: Scratch that, I see that the previous screenshot does indeed have -P in it, but that was taken when I tried using a new profile to test the result. This no longer appears in the commandline though as this screenshot demonstrates.

Okay, thanks, we can rule out the profile manager as a potential culprit/explanation.

Are the external links showing up in your main session? For example, they appear in History, and/or on History > Recently closed tabs or History > Recently closed windows after you close them.

Is there anything special about your main Firefox process, e.g., sandboxed, run as Administrator, or otherwise unusual?

Firefox used to set up the association in the Windows registry to use DDE, but that was discontinued years ago. I wonder whether the registry keys are a bit messed up on yours.

On my system (32-bit Firefox on 64-bit Windows 7), regedit.exe shows me:

HKEY_CLASSES_ROOT\FirefoxURL\shell\open\command (Default) "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1"

HKEY_CLASSES_ROOT\FirefoxURL\shell\open\ddeexec (Default) [blank]

jscher2000 said

Okay, thanks, we can rule out the profile manager as a potential culprit/explanation. Are the external links showing up in your main session? For example, they appear in History, and/or on History > Recently closed tabs or History > Recently closed windows after you close them. Is there anything special about your main Firefox process, e.g., sandboxed, run as Administrator, or otherwise unusual?

---

Firefox used to set up the association in the Windows registry to use DDE, but that was discontinued years ago. I wonder whether the registry keys are a bit messed up on yours.

On my system (32-bit Firefox on 64-bit Windows 7), regedit.exe shows me:

HKEY_CLASSES_ROOT\FirefoxURL\shell\open\command (Default) "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1"

HKEY_CLASSES_ROOT\FirefoxURL\shell\open\ddeexec (Default) [blank]

I've actually found information on these before, sadly everything is as it should. "D:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" for command and the other one is blank.

Did you try to boot the computer in Windows Safe Mode with network support?

cor-el said

Did you try to boot the computer in Windows Safe Mode with network support?

I had forgotten to do this. I have just done it now and to my surprise, it does not occur in safe mode. However, out of your list so far, I have done scans with Windows Defender, Malwarebytes, and Adwcleaner. I have found no results so far.

EDIT: I'd like to ask by the way if any of you have Windows 10, does Windows 10's Safe Mode with Networking only allow ethernet connections and no wireless? I'm having this issue but I don't find much searching on it.

I don't know about Windows 10 not allowing wi-fi in Safe Mode with Networking. Perhaps it depends on whether Windows is managing the wi-fi or a third party program such as Intel's.

Well, I solved the problem. I have no idea what has caused this interference, but you all are probably going to leave scratching your heads over this one as I sure am.

After pinpointing that the problem doesn't occur when booting in safe mode, I wanted to track down what service/program caused this. First I disabled all start up services, no luck. I then disabled all start up programs and it did stop the issue. I then, one by one, rebooted by only having one enabled at a time and pinpointed the program causing the issue.

An audio manager known as Nahmihic2 handles sound enhancements for my MSI computer. It does not do anything browser or web-related. It's just an audio manager you get from my computer's support page on the MSI site. However, if this program is open, Firefox will not close external processes once they are used to open an external link. I can simply exit the program and it works as intended.

Why this is the case? I haven't the faintest idea. I even recently updated Nahimic2 after posting about this issue. If the update didn't fix it and no Firefox update fixes it, then this is a problem that's likely never going to be resolved on either end as it's unknown who's at fault here.

I thought I'd share this surprising piece of information. If you guys have any idea how to possibly stop this interference, please let me know. Otherwise this problem can be marked as resolved.